Terraform on Alwaldend

Org1

Mon, 01 Jan 0001 00:00:00 +0000

Pve vm qemu

Mon, 01 Jan 0001 00:00:00 +0000

Terraform setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf backend

Mon, 01 Jan 0001 00:00:00 +0000

The plugin tracks each running backend for shutdown, including backends created before a later call fails. Shutdown drains HTTP requests before revoking the backend’s invocation-owned Vault credentials. If the shutdown deadline expires, connections are forcibly closed and the timeout is reported. Normal HTTP server closure is not an error. Vault requests use their incoming request context.

Tf modules

Mon, 01 Jan 0001 00:00:00 +0000

This project contains reusable Terraform modules for Vault configuration, Proxmox virtual machines, backup storage, and related infrastructure. The module collection is still in progress.

Features

Terraform modules

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Vault

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/vault/tf_setup:tf.apply # Create VMs (requires an active Vault host)
bazel run //infra/vault/ansible # Set up hosts (BM and VMs)
bazel run //infra/vault/tf:tf.apply # Configure vault

Backup

bazel run //infra/vault:backup

Unseal

With a working Vault:

bazel run //infra/vault:unseal

Without a working Vault:

bazel run //infra/vault:unseal_standalone

Fix quorum

bazel run //infra/vault/ansible:fix_quorum

Set up only VMs

bazel run //infra/vault/ansible:ansible.vm # Set up only VMs

Set up only bare metal

bazel run //infra/vault/ansible:ansible.bm # Set up only bare metal

Tf

Plan:

Vault approle

Mon, 01 Jan 0001 00:00:00 +0000

Vault approle

Mon, 01 Jan 0001 00:00:00 +0000

Vault OIDC provider

Mon, 01 Jan 0001 00:00:00 +0000

Vault pki server

Mon, 01 Jan 0001 00:00:00 +0000

Vault transit key

Mon, 01 Jan 0001 00:00:00 +0000

XCP-ng

Mon, 01 Jan 0001 00:00:00 +0000

The dc1 DNS configuration maps xcp-ng.alwaldend.com and host1.xcp-ng.alwaldend.com to 192.168.1.213.

Terraform lives in internal/tf and declares the pinned vatesfr/xenorchestra provider. It includes empty provider and HTTP backend blocks, with no resources, endpoints, or credentials. The provider requires Xen Orchestra connected to the XCP-ng pool when resources are added.

al.lua authenticates with the src_infra_xcp_ng Vault AppRole and configures the HTTP backend using secrets/alwaldend.com/vault1/approles/src_infra_xcp_ng/tf_backend. The AppRole is declared in infra/vault/tf and must be provisioned before running the Terraform commands. Provider connection settings are left to the operator.

Terraform on Alwaldend

Org1

Links

Pve vm qemu

Terraform setup

Tf

Tf

Tf

Tf

Tf

Tf

Tf

Tf

Tf

Tf

Tf

Tf backend

Tf modules

Links

Features

Tf setup

Tf setup

Tf setup

Tf setup

Tf setup

Vault

Links

Deployment

Backup

Unseal

Fix quorum

Set up only VMs

Set up only bare metal

Tf

Vault approle

Vault approle

Vault OIDC provider

Vault pki server

Vault transit key

Links

XCP-ng